Search

SingCERT Security Bulletin Summarizes NIST Vulnerability Database

The Cyber Security Agency of Singapore (CSA) SingCERT published a security bulletin summarizing critical vulnerabilities from NIST's National Vulnerability Database. The bulletin categorizes CVEs by CVSSv3 base scores, listing vulnerabilities scoring 9.0-10.0 (Critical), 7.0-8.9 (High), 4.0-6.9 (Medium), and 0.1-3.9 (Low). Critical vulnerabilities include Axios prototype pollution (CVE-2026-40175, score 10.0), Sonicverse SSRF (CVE-2026-40089, score 9.9), SAP SQL injection (CVE-2026-27681, score 9.9), Axios proxy bypass (CVE-2025-62718, score 9.9), and PraisonAI sandbox escape (CVE-2026-39888, score 9.9).

Multiple Vulnerabilities in Synology SSL VPN Client Prior to 1.4.5-0684

CERT-FR published advisory CERTFR-2026-AVI-0431 alerting to multiple vulnerabilities in Synology SSL VPN Client affecting versions prior to 1.4.5-0684. The vulnerabilities could allow attackers to compromise data confidentiality and integrity. The advisory references Synology security bulletin Synology_SA_26_05 and two CVEs (CVE-2021-47960 and CVE-2021-47961). Organizations using the affected product should consult the vendor's security bulletin for patch information.

Multiple Vulnerabilities in SAP Products Allow Remote Code Execution

CERT-FR published advisory CERTFR-2026-AVI-0434 alerting organizations that multiple vulnerabilities have been discovered in SAP products. Affected systems span SAP NetWeaver Application Server ABAP and Java, S/4HANA, BusinessObjects, and numerous other SAP platforms across versions 700-816. The vulnerabilities expose organizations to remote code execution, SQL injection, cross-site scripting, denial of service, and data confidentiality breaches.

Multiple Microsoft Product Vulnerabilities, 4 CVEs

CERT-FR issued advisory CERTFR-2026-AVI-0435 warning of four unpatched vulnerabilities (CVE-2026-27456, CVE-2026-3184, CVE-2026-34933, CVE-2026-4878) in Microsoft products affecting azl3 and cbl2 system versions. The vulnerabilities allow attackers to cause unspecified security issues. Organizations running affected azl3 versions of avahi, libcap, and util-linux, or cbl2 versions of avahi and libcap, should apply patches per Microsoft security bulletins.

Multiple Vulnerabilities in Siemens Products Allow Remote Code Execution

CERT-FR issued security advisory CERTFR-2026-AVI-0432 detailing multiple vulnerabilities in Siemens industrial automation products including SCALANCE W-700, SIMATIC CN/Field/IPC series, and related industrial computing devices. The vulnerabilities enable remote code execution, privilege escalation, denial of service, cross-site scripting, and data confidentiality breaches. Affected parties should immediately consult Siemens security bulletins SSA-019200 and SSA-628843 for available patches and apply mitigations.

Multiple Vulnerabilities in Python Allowing Remote Code Execution

CERT-FR issued advisory CERTFR-2026-AVI-0430 warning of multiple vulnerabilities in Python/CPython affecting systems without latest security patches. Two CVEs are referenced: CVE-2026-4786 and CVE-2026-6100. The vulnerabilities allow remote code execution and other unspecified security issues. Organizations running CPython should consult vendor security bulletins for patches.

Multiple Schneider Electric Vulnerabilities, Data Integrity and Confidentiality Risk

CERT-FR published advisory CERTFR-2026-AVI-0433 disclosing multiple vulnerabilities in Schneider Electric industrial control products. Affected products include Easergy MiCOM protection relays (multiple models), EcoStruxure Control Expert, Connexium Managed Switches, and Modicon Redundancy Switches. The vulnerabilities enable remote denial of service, data confidentiality breaches, data integrity compromise, and security policy bypass. Organizations should refer to vendor security bulletins for patches.

ESRI ArcGIS Multiple Vulnerabilities, CVSS 9.8 (Critical)

CERT-Bund issued a security advisory about multiple critical vulnerabilities in ESRI ArcGIS geographic information system software (versions 11.5 and 12.0) with a CVSS Base Score of 9.8 (critical) and Temporal Score of 8.5 (high). An attacker can exploit these vulnerabilities remotely to elevate privileges or bypass security measures. Organizations using affected ArcGIS products should apply available mitigations.

MinIO Object Storage Multiple Authentication Bypass Vulnerabilities - CVSS 8.2

CERT-Bund issued security advisory WID-SEC-2026-1081 identifying multiple vulnerabilities in MinIO object storage software with CVSS Base Score 8.2 (High) and Temporal Score 7.1 (High). Remote anonymous attackers can exploit these flaws to bypass authentication and manipulate data. Affected version: Open Source MinIO prior to 2026-04-11T03-20-12Z.

Apache Airflow Vulnerabilities Allow Code Execution

Apache Airflow Vulnerabilities Allow Code Execution